This reverts commit 16ab7cb5825fc3425c16ad2c6e53d827f382d7c6 because it broke iwd. iwd uses the KEYCTL_PKEY_* UAPIs via its dependency libell, and apparently it is relying on SHA-1 signature support. These UAPIs are fairly obscure, and their documentation does not mention which algorithms they support. iwd really should be using a properly supported userspace crypto library instead. Regardless, since something broke we have to revert the change. It may be possible that some parts of this commit can be reinstated without breaking iwd (e.g. probably the removal of MODULE_SIG_SHA1), but for now this just does a full revert to get things working again.
Showing the changes to kernel/module (1 of 8 files). Show all
Unified · Split
| @@ -236,6 +236,10 @@ choice · 235 unmodified lines | ||
| 236 | 236 | possible to load a signed module containing the algorithm to check |
| 237 | 237 | the signature on that module. |
| 238 | 238 | |
| 239 | +config MODULE_SIG_SHA1 | |
| 240 | + bool "Sign modules with SHA-1" | |
| 241 | + select CRYPTO_SHA1 | |
| 242 | + | |
| 239 | 243 | config MODULE_SIG_SHA256 |
| 240 | 244 | bool "Sign modules with SHA-256" |
| 241 | 245 | select CRYPTO_SHA256 |
| @@ -265,6 +269,7 @@ endchoice · 23 unmodified lines | ||
| 265 | 269 | config MODULE_SIG_HASH |
| 266 | 270 | string |
| 267 | 271 | depends on MODULE_SIG || IMA_APPRAISE_MODSIG |
| 272 | + default "sha1" if MODULE_SIG_SHA1 | |
| 268 | 273 | default "sha256" if MODULE_SIG_SHA256 |
| 269 | 274 | default "sha384" if MODULE_SIG_SHA384 |
| 270 | 275 | default "sha512" if MODULE_SIG_SHA512 |